Send only the Referer's scheme and host to Sentry (closes #548)

A Sentry event kept the Referer header verbatim, and a Referer can be
an entrypoint URL: a sender that follows the README's http:// to
https:// redirect sends the URL it was redirected from, and a browser
sends the 404 page's URL under /h/ when it fetches that page's
stylesheet. The Sentry hook now keeps only the Referer's scheme and
host. The access log's reduction moves, unchanged, into a new package,
internal/referer, as SchemeAndHost; the access log and the Sentry hook
both call it there. The comment above sentryKeepsHeader and the
README's Sentry passage say so.

Model: opus-5-5

internal/server/sentry.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/getsentry/sentry-go"
 	"github.com/go-chi/chi"
+	"sneak.berlin/go/webhooker/internal/referer"
 )
 
 // sentryRedacted stands in for a withheld field on every event shipped
@@ -253,6 +254,7 @@ func sentryTransactionName(name, pattern string) string {
 // gorilla/csrf accepts in place of the form field — and the shared
 // secrets senders put on the receiver route (X-Gitlab-Token and the
 // per-provider signature headers) would otherwise ship verbatim.
+// The Referer it keeps is cut down to its scheme and host.
 func keptSentryHeaders(headers map[string]string) map[string]string {
 	if len(headers) == 0 {
 		return headers
@@ -261,9 +263,15 @@ func keptSentryHeaders(headers map[string]string) map[string]string {
 	kept := make(map[string]string, len(headers))
 
 	for name, value := range headers {
-		if sentryKeepsHeader(name) {
-			kept[name] = value
+		if !sentryKeepsHeader(name) {
+			continue
 		}
+
+		if http.CanonicalHeaderKey(name) == "Referer" {
+			value = referer.SchemeAndHost(value)
+		}
+
+		kept[name] = value
 	}
 
 	return kept
@@ -271,11 +279,14 @@ func keptSentryHeaders(headers map[string]string) map[string]string {
 
 // sentryKeepsHeader reports whether a request header is routing or
 // content metadata rather than client-chosen payload. Referer is kept
-// on the reasoning that it is browser-set, that the only query
-// parameters in this service's own URLs are the login page's `next`,
-// `notice` and the event log's `show`, and that Referrer-Policy is set to
-// strict-origin-when-cross-origin. X-Request-Id ties the event to the
-// local access log line, which holds the rest of the detail.
+// only as its scheme and host, through referer.SchemeAndHost, which
+// the access log uses too: its path can be an entrypoint URL, which
+// carries the UUID, as when a sender follows a redirect from http://
+// to https:// or a browser fetches the 404 page's stylesheet from
+// under /h/. The scheme and host are all gorilla/csrf compares a
+// Referer by, so a CSRF rejection is still readable from the event.
+// X-Request-Id ties the event to the local access log line, which
+// holds the rest of the detail.
 func sentryKeepsHeader(name string) bool {
 	switch http.CanonicalHeaderKey(name) {
 	case "Accept",